ssrf-filter-agent

Introduction

This module provides a custom http.Agent/https.Agent to protect against SSRF.

The module is standalone and comes with its own ip address parser. Both IPv4 and IPv6 are supported.

If the dns response contains an internal ip address or if one is passed to the agent directly, an exception is thrown.

Installation

$ npm install ssrf-filter-agent

Usage

const sfa = require('ssrf-filter-agent');
const got = require('got');

async function fn() {
    var res = await got.get('https://127.0.0.1.xip.io', {
        agent: {
            http: new sfa.FilteredHttpAgent(),
            https: new sfa.FilteredHttpsAgent()
        }
    });
}
fn();